Effects of Individual Self-Protection, Industry Self-Regulation, and Government Regulation on Privacy Concerns: a Study of Location-Based Services
Total Page:16
File Type:pdf, Size:1020Kb
This article was downloaded by: [130.203.152.80] On: 19 February 2014, At: 06:34 Publisher: Institute for Operations Research and the Management Sciences (INFORMS) INFORMS is located in Maryland, USA Information Systems Research Publication details, including instructions for authors and subscription information: http://pubsonline.informs.org Research Note—Effects of Individual Self-Protection, Industry Self-Regulation, and Government Regulation on Privacy Concerns: A Study of Location-Based Services Heng Xu, Hock-Hai Teo, Bernard C. Y. Tan, Ritu Agarwal, To cite this article: Heng Xu, Hock-Hai Teo, Bernard C. Y. Tan, Ritu Agarwal, (2012) Research Note—Effects of Individual Self-Protection, Industry Self-Regulation, and Government Regulation on Privacy Concerns: A Study of Location-Based Services. Information Systems Research 23(4):1342-1363. http://dx.doi.org/10.1287/isre.1120.0416 Full terms and conditions of use: http://pubsonline.informs.org/page/terms-and-conditions This article may be used only for the purposes of research, teaching, and/or private study. Commercial use or systematic downloading (by robots or other automatic processes) is prohibited without explicit Publisher approval. For more information, contact [email protected]. The Publisher does not warrant or guarantee the article’s accuracy, completeness, merchantability, fitness for a particular purpose, or non-infringement. Descriptions of, or references to, products or publications, or inclusion of an advertisement in this article, neither constitutes nor implies a guarantee, endorsement, or support of claims made of that product, publication, or service. Copyright © 2012, INFORMS Please scroll down for article—it is on subsequent pages INFORMS is the largest professional society in the world for professionals in the fields of operations research, management science, and analytics. For more information on INFORMS, its publications, membership, or meetings visit http://www.informs.org Information Systems Research Vol. 23, No. 4, December 2012, pp. 1342–1363 ISSN 1047-7047 (print) ISSN 1526-5536 (online) http://dx.doi.org/10.1287/isre.1120.0416 © 2012 INFORMS Research Note Effects of Individual Self-Protection, Industry Self-Regulation, and Government Regulation on Privacy Concerns: A Study of Location-Based Services Heng Xu College of Information Sciences and Technology, The Pennsylvania State University, University Park, Pennsylvania 16802, [email protected] Hock-Hai Teo Department of Information Systems, National University of Singapore, School of Computing, Singapore 117418, [email protected] Bernard C. Y. Tan Department of Information Systems, National University of Singapore, School of Computing, Singapore 117418, [email protected] Ritu Agarwal Robert H. Smith School of Business, University of Maryland, College Park, Maryland 20742, [email protected] his study seeks to clarify the nature of control in the context of information privacy to generate insights into Tthe effects of different privacy assurance approaches on context-specific concerns for information privacy. We theorize that such effects are exhibited through mediation by perceived control over personal information and develop arguments in support of the interaction effects involving different privacy assurance approaches (individual self-protection, industry self-regulation, and government legislation). We test the research model in the context of location-based services using data obtained from 178 individuals in Singapore. In general, the results support our core assertion that perceived control over personal information is a key factor affecting context-specific concerns for information privacy. In addition to enhancing our theoretical understanding of the link between control and privacy concerns, these findings have important implications for service providers and consumers as well as for regulatory bodies and technology developers. Key words: privacy; context-specific concerns for information privacy; psychological control; control agency; individual self-protection; industry self-regulation; and government regulation History: Elena Karahanna, Senior Editor; Mariam Zahedi, Associate Editor. This paper was received on August 20, 2008, and was with the authors 24 months for 4 revisions. Published online in Articles in Advance April 18, 2012. 1. Introduction online transactions or adoptions of new technologies Information privacy is an increasingly critical concern in the presence of significant privacy concerns. for many individuals around the world. The global It has been posited that individuals tend to have diffusion of mobile technologies and the unbounded lower privacy concerns if they perceive a certain options for gathering, storing, processing, disseminat- degree of control over the collection and use of their personal information (Dinev and Hart 2004, ing, and exploiting personal information trigger con- Xu et al. 2008). Considering the potential impor- sumer concerns (FTC 2010). Over the past decade, Downloaded from informs.org by [130.203.152.80] on 19 February 2014, at 06:34 . For personal use only, all rights reserved. tance of control in the context of information privacy, scholars in information systems have examined the this study explores and empirically demonstrates topic of privacy concerns (e.g., Angst and Agarwal the contribution of the psychological control theo- 2009, Bansal et al. 2010, Dinev and Hart 2006, Malho- ries to understanding information privacy. We con- tra et al. 2004, Son and Kim 2008) related to the collec- ducted an experimental study in the specific context tion and use of personal information from a variety of location-based services (LBS). Three privacy assur- of different perspectives. A general conclusion from ance approaches (individual self-protection, indus- this stream of research is that individuals would resist try self-regulation, and government legislation) were 1342 Xu et al.: Privacy Assurances, Perceived Control, and Privacy Concerns Information Systems Research 23(4), pp. 1342–1363, © 2012 INFORMS 1343 manipulated in the experiment and their effects dissemination, and invasion activities. Culnan and on control perceptions and privacy concerns were Williams (2009) argue that these activities on infor- examined. mation reuse and unauthorized access by organiza- The current study contributes to existing pri- tions “can potentially threaten an individual’s ability vacy research in several important ways. First, prior to maintain a condition of limited access to his/her research has shown a lack of clarity in explicating personal information” (p. 675). Solove’s groundwork the link between control and privacy: some studies (2007) for a pluralistic conception of privacy differen- have defined privacy as control per se (e.g., Goodwin tiates the concept of privacy (as an individual state) 1991, Milne and Rohm 2000); others have positioned from the management of privacy (arising from organi- control as a key factor shaping privacy (e.g., Laufer zational information processing activities). From the and Wolfe 1977, Dinev and Hart 2004). There have perspectives of individuals (Dhillon and Moores 2001, been very few attempts to bring control theories into Schoeman 1984), we define privacy as a state of lim- privacy research to clarify the nature of control. The ited access to personal information. current research contributes to this controversial issue Another challenge faced in understanding privacy by explicating this control—privacy contention. Sec- is the diversity of measurements used by prior ond, following the call by Margulis (2003a, b), cur- research. Measures that have been adopted for the rent research has explicitly integrated the literature on examinations of privacy include attitudes toward pri- psychological control into theories of privacy. Toward vacy (e.g., Buchanan et al. 2007), concerns for privacy this end, we have adopted the control agency the- (e.g., Smith et al. 1996), and privacy-related behav- ory to make a theoretical distinction of different pri- ioral intentions (e.g., Dinev and Hart 2006). Based on vacy assurance approaches by explicitly linking them an extensive review of privacy literature, Smith et al. with different types of control agencies. Finally, most (2011) note that the variable of “privacy concerns” existing privacy research focuses on examining the becomes the central construct within IS research and individual effect of privacy assurance approaches it has become the proxy to operationalize the con- (e.g., Culnan and Bies 2003, Metzger 2006). Build- cept of “privacy.” Specifically, the Smith et al. (1996) ing on the control agency framework, this research Concern for Information Privacy (CFIP) scale has extends the literature by proposing interaction effects been considered as one of the most reliable scales of these privacy assurance approaches on alleviating for measuring privacy concerns, using four data- privacy concerns, based on the type of control agen- related dimensions: collection, errors, unauthorized cies they can provide. secondary use, and improper access to information. In what follows, we first provide an overview of As Bansal et al. (2008) note, these four dimensions of prior relevant literature to establish a theoretical foun- CFIP supported the underlying definitions of the U.S. dation for studying privacy, privacy concerns, control, Federal Trade Commission’s (FTC) fair information and privacy assurance approaches. Then we develop practices (FTC 2000), which include the